CVE Vulnerability Catalog

Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-path attacker to intercept and tamper with VNC sessions via automatic acceptance of the server's RSA key during RSA-AES authentication.

An out-of-bounds read/write vulnerability in the MessageParser::parseECSSTCHeader component of SpaceDot AcubeSAT OBC software allows attackers to cause a Denial of Service (DoS) via a crafted CAN message.

Aria2 version 1.37.0 and below is affected by a Divide By Zero issue in src/bittorrent_helper.cc, which allows a remote malicious user to cause a Denial of Service.

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint. Authenticated attackers with expense-creation rights can bypass the approval workflow by directly setting approval status and approver identity fields. Attackers can manipulate workflow state fields to advance expense reports to approved or closed status without possessing the dedicated approval right, while also creating forensic inconsistencies in audit records due to missing approval timestamps.

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API update endpoint. Attackers with user-write rights can modify payroll fields by exploiting an incomplete credential denylist that omits payroll columns. Attackers can rewrite salary, bonus, hourly rate, daily rate, and weekly hours for any user without holding payroll rights, with the modified values appearing in payroll export reports.

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes. Authenticated attackers with third-party creation rights can create, replace, or delete bank account details of any company without requiring read access to that company. Attackers can inject attacker-controlled IBANs as creditor accounts, which are then written into regenerated SEPA credit-transfer files, redirecting outgoing payments to attacker-controlled accounts.

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticated attacker can cause an authenticated administrator to open a crafted URL to execute arbitrary JavaScript in that session and create a persistent administrator account.

The file-pix (ESM) plugin in GIMP contains a flaw where it allocates a Variable-Length Array (VLA) on the stack without proper bounds checking when processing a specially crafted PIX image file, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a denial of service due to stack exhaustion and a limited information disclosure of stack memory contents into an intermediate file.

Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/account/ stores the first_name value verbatim, and the mention renderer in web-frontend/modules/core/editor/mention.js builds its element with a template literal that places the name into a data-label attribute and the element body unescaped. A name containing a double quote closes that attribute and the opening tag, so following markup lands in the element content. The result is rendered through v-html by the rich-text field components, so any rich-text cell mentioning the account executes the stored script for every workspace member who views the table, without a click. Any workspace member, at the lowest permission level, can set the name and reach every other member of the workspace, and the payload persists until the name is changed or the mentioning row is removed. Version 2.3.0 escapes the value before interpolation.

Multiple DrayTek VigorSwitch models contain a directory traversal vulnerability in the getSyslogFile function due to insufficient validation of the option field. A remote attacker can access arbitrary files on the device via crafted input. Exploitation requires valid administrative credentials for the web management interface.

Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function due to missing checks for an empty or absent Cookie header. A remote attacker can crash the service and cause a denial of service. Exploitation requires valid administrative credentials.

Johnson Controls Metasys 14 and 15 contain a cross-site scripting (XSS) vulnerability due to improper input neutralization during web page generation. Affected versions: Metasys 14 before 14.1.5; Metasys 15 before 15.0.1.

A vulnerability in the Hearing Access Service (HAS) in Zephyr RTOS allows a remote (Bluetooth) crash of the HAS peripheral. The issue occurs when a previously bonded client reconnects during the startup window before the application registers the service, leading to an assertion or NULL pointer dereference.

rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability allowing authenticated users to read arbitrary files by supplying crafted filenames with traversal sequences to the export download endpoint. Attackers can escape the intended export directory and access files readable by the application process.

Unauthenticated REST disclosure of certain content items in Apache Allura. This issue affects Apache Allura through 1.19.1.

A vulnerability in the Apache Camel Knative component allows an unauthenticated attacker to inject Camel-internal headers (e.g., CamelHttpUri, CamelHttpPath, CamelFileName) via a structured-mode CloudEvent request. This occurs because CloudEvent extension attributes are copied to Exchange headers without filtering, enabling override of configured values in routes forwarding messages to header-driven components such as camel-http or camel-file.

A relative path traversal vulnerability in the Apache Camel Azure-Storage Datalake component allows writing files outside the configured target directory during the downloadToFile operation. Remote file names with parent-directory segments are not normalized or checked, enabling creation or overwriting of files at arbitrary locations accessible to the Camel process.

Vulnerability in Apache Camel involves improper input validation in the camel-mail component. When MimeMultipart data format is configured with headersInline=true, MIME headers from the message are copied to Camel headers without filtering, allowing an attacker to inject headers from Camel's internal namespace and override component behavior.

Multiple vulnerabilities exist in OpenThread's handling of MLE packets. An authenticated attacker on the same Thread network could send specially crafted packets to cause a denial of service. These issues include triggerable assertion failures and a stack-based buffer overflow.

Broken access control vulnerability in BookStack before 26.05.4 allows authenticated API users with image-update or image-delete permissions to manipulate other users' avatars by exploiting missing content-type restrictions in the Image Gallery API endpoints.